Threats affecting pkg:cpan/ExtUtils-Typemaps-Default

CVE-2026-107794 is an integer underflow vulnerability in ExtUtils::Typemaps::STL::List for Perl versions before 1.07. The flaw causes the module to allocate a very large 32 GiB array when processing an empty list due to an underflow in the av_extend function call. This results in memory exhaustion. A similar issue was previously fixed in the related ExtUtils::Typemaps::STL::Vector module.

ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument. The typemap uses $var = std::string( SvPV_nolen($arg), SvCUR($arg) ) However, evaluation order for C++ arguments is not specified, and some compilers may produce code that evalutes SvCUR($arg) first. When $arg is not a string (for example, an interger, number or a reference) then SvCUR will return an invalid value, and the program may abort or segfault.